一句话：提出 Tacoma 浏览器模糊测试框架，借助细粒度语义对齐与作用域感知生成语义正确且多样的测试输入，在三大浏览器上发现 32 个新漏洞。
浏览器需要解释来自 web 的各类数据，其复杂性使漏洞难以彻底消除。现有浏览器模糊测试技术面临一个固有难题：生成的测试输入语义正确性低、多样性差，因而难以触达深层浏览器状态。本文提出 Tacoma，一个面向浏览器的模糊测试框架，由语义解析器、语义对齐器和输入生成器三个模块组成。通过细粒度语义对齐技术，Tacoma 能生成语义正确的测试输入，显著提升模糊器触发深层浏览器状态的概率；同时，输入生成中引入作用域感知（scope-aware）策略以处理异步代码生成，大幅提高生成输入的多样性。作者在 Chromium、Safari 和 Firefox 三个生产级浏览器上进行了大量实验，结果表明 Tacoma 在代码覆盖率和唯一崩溃发现数上均优于当前最先进的浏览器模糊器。迄今 Tacoma 已发现 32 个此前未知的缺陷，其中 10 个被分配 CVE 编号，并在 Chromium 中发现两个潜伏十年的缺陷。
Browsers are responsible for managing and interpreting the diverse data coming from the web. Despite the considerable efforts of developers, however, it is nearly impossible to completely eliminate potential vulnerabilities in such complicated software. While a family of fuzzing techniques has been proposed to detect flaws in web browsers, they still face the inherent challenge of generating test inputs with low semantic correctness and poor diversity. In this paper, we propose Tacoma, a novel fuzzing framework tailored for web browsers. Tacoma comprises three main modules: a semantic parser, a semantic aligner, and an input generator. By taking advantage of fine-grained semantic alignment techniques, Tacoma is capable of generating semantically correct test inputs, which significantly improve the probability of a fuzzer in triggering a deep browser state. In particular, by integrating a scope-aware strategy into input generation, Tacoma is able to deal with asynchronous code generation, thereby substantially increasing the diversity of the generated test inputs. We conduct extensive experiments to evaluate Tacoma on three production-level browsers, i.e., Chromium, Safari, and Firefox. Empirical results demonstrate that Tacoma outperforms state-of-the-art browser fuzzers in both achieving code coverage and detecting unique crashes. So far, Tacoma has identified 32 previously unknown bugs, 10 of which have been assigned CVEs. It is worth noting that Tacoma unearthed two bugs in Chromium that have remained undetected for ten years.
DOI 原文 ·
@inproceedings{paperbot8502,
title = {Tacoma: Enhanced Browser Fuzzing with Fine-Grained Semantic Alignment},
author = {Jiashui Wang and Peng Qian and Xilin Huang and Xinlei Ying and Yan Chen and Shouling Ji and Jianhai Chen and Jundong Xie and Long Liu},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680351}
}